World ID Comes to Banks: Proving You're Human on Video Calls in the Deepfake Era

Deepfake technology has reached the point where it can impersonate a real person on a live video call. World is pitching banks an iris-scan-based proof of personhood layer to counter the problem. The logic behind the idea is sound. But the solution raises a new question: How safe is it to tie human verification on video calls to the infrastructure of a single private company?

What happened?

World (formerly Worldcoin), whose co-founders include Sam Altman and Alex Blania, unveiled its World ID solution for banking and finance at the Money20/20 conference. The system promises to cryptographically prove that the other party on a video call on platforms like Zoom, or in a transaction carried out with AI agents, is a real, verified human. The foundation of the verification is an iris scan performed with the company's device, the Orb.

Why does it matter?

Video calls long rested on the principle of "seeing is believing." That assumption no longer holds. In 2024 in Hong Kong, an employee of the engineering firm Arup transferred roughly $25 million after a video meeting attended by deepfake copies of their executives. The incident showed that fake faces and voices can be convincing even in live settings. For banks, the risk runs both ways: Someone posing as a customer can open a fraudulent account, and someone posing as a bank representative can defraud a customer.

Banks' current defenses rely largely on KYC processes: ID document checks, liveness tests, and observation by the representative on the call. These methods answer the question "Is the document genuine, and does the person in front of me resemble the one on it?" World highlights a different question: Is the party in front of me a human? As generative AI becomes able to imitate image and voice, this second question may call for a separate verification layer.

The problem is who this layer is entrusted to. World's iris collection activities have been suspended or placed under investigation in countries such as Kenya, Spain, Portugal, and Indonesia. In Germany, Bavaria's data protection authority ordered the deletion of data. The company says it keeps iris data split into fragments and encrypted, and that it verifies people without sharing personal information using zero-knowledge proofs. The technical design is a serious piece of work. The real debate is about trust and governance.

How does it affect banks and users?

The appeal for banks is clear. There is an endless race between deepfake detection software and the models that generate fake content. Cryptographic proof moves this race out of image analysis and into mathematics. But there is a price. If verification is tied to a single provider, that provider's outage, a ban in one country, or a change in business model flows directly into the bank's customer relationship. A company that grew up on a crypto token economy taking on a critical infrastructure role in a tightly regulated sector is also something regulators will question.

On the user side, the issue is more fundamental. A password can be changed; an iris cannot. Once biometric data leaks or is misused, there is no going back. Even if World's claim that it works with a derivative rather than raw data is true, asking users to find an Orb and have their eyes scanned by a private company is a high bar in terms of access and consent.

What would it mean for opening accounts by video call in Türkiye?

Türkiye is among the countries that regulated customer onboarding by video call early, through the BDDK's remote identity verification regulation, which took effect in 2021. The model combines a live call with a customer representative, reading the NFC chip on the ID card, and a liveness check. Chip reading is a strong shield against forged documents. The weak link is the video call itself, which is exactly what deepfakes target.

A World-like solution looks unlikely to spread in Türkiye in the short term. The KVKK classifies biometric data as special-category personal data. Rules on transfers abroad and explicit consent are strict. Banking regulation also limits outsourcing for critical processes. A more likely path is for banks to invest more in deepfake detection and liveness checks, and to make better use of the biometric photo on the NFC chip for matching.

What's next?

Three things are worth watching. First, which markets banks that sign deals with World will exit. Second, how European data protection authorities react to this use case. Third, how the need for proof of personhood will be standardized as transactions on behalf of AI agents become widespread. State-backed projects such as the EU's digital identity wallet initiative are candidates to offer a public answer to the same question.

Seeking a cryptographic answer to deepfakes is the right direction. But tying that answer to a single private company's iris database creates a new strategic dependency even as it closes a security gap. The healthy path for banks is to base proof of personhood not on a single provider, but on interoperable open standards.